Core system binary started by an unexpected parent

1title: Core system binary started by an unexpected parent2id: 84eba238-f158-439f-bd5b-cc15136519c73status: experimental4description: |5  AN1076 describes the hollowing sequence — CreateProcess with CREATE_SUSPENDED,6  NtUnmapViewOfSection, VirtualAllocEx and WriteProcessMemory, then7  SetThreadContext and ResumeThread — and none of the three log sources in the8  strategy carries any step of it. Sysmon EventID 1 has no field for process9  creation flags, so the suspended start is invisible; EventID 10 does not fire10  because the injector creates the victim itself and already holds the handle,11  so it never calls OpenProcess; EventID 8 does not fire because execution12  resumes the child's existing primary thread rather than creating a remote one.13  What remains observable is the decoy itself, which is what MITRE's14  HollowedImageNamePattern knob points at, populated here not with a name list15  but with the small set of Windows binaries that have exactly one legitimate16  creator — svchost.exe and spoolsv.exe come from services.exe, lsass.exe and17  services.exe from wininit.exe, csrss.exe, wininit.exe and winlogon.exe from18  smss.exe — so any other parent is an anomaly on its face. The rule is written19  in Sysmon EventID 1 vocabulary (Image, ParentImage); on Security 4688 the20  equivalent fields are NewProcessName and ParentProcessName and Audit Process21  Creation must be enabled first, a mapping this rule does not carry.22  Prerequisite: Sysmon is not present in a default install. Two limits are23  structural: a hit is evidence of an anomalous launch, not of hollowing —24  masquerading under a system binary name produces the identical event — and a25  hollowed process created under a plausible parent, or hollowed into a decoy26  outside this list, is missed entirely.27  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0382, not hand-written and not tested by its author. Any lab result is on this rule's own page.28references:29  - https://attack.mitre.org/techniques/T1055/01230  - https://attack.mitre.org/detectionstrategies/DET038231author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)32date: 2026-08-1633tags:34  - attack.defense-evasion35  - attack.privilege-escalation36  - attack.t1055.01237logsource:38  category: process_creation39  product: windows40detection:41  selection:42    Image|endswith:43      - '\svchost.exe'44      - '\spoolsv.exe'45      - '\lsass.exe'46      - '\services.exe'47      - '\csrss.exe'48      - '\wininit.exe'49      - '\winlogon.exe'50  filter_parent:51    ParentImage|endswith:52      - '\services.exe'53      - '\wininit.exe'54      - '\smss.exe'55  condition: selection and not filter_parent56falsepositives:57  - "Windows container hosts, where every container start brings up wininit.exe, services.exe, csrss.exe and svchost.exe under the container runtime rather than under the usual creator. On such a host this is the highest-volume match by a wide margin and needs a ParentImage exclusion for the runtime before the rule is usable at all. This is what sets the level."58  - "Administrators and support scripts troubleshooting a wedged service by hand, for example launching svchost.exe with a service group from an elevated console or restarting the print spooler out of band, which puts cmd.exe or a shell under ParentImage."59  - "Third-party software that ships a binary with one of these file names in its own directory and starts it from a vendor updater or service wrapper; the match is on file name, not on path, so a bundled spoolsv.exe or services.exe under Program Files matches the same way the real one would."60  - "Imaging, sysprep and OS-deployment tooling, plus nested-session hosts such as Windows Sandbox and remote-desktop session brokers, all of which start session-level system processes from a launcher of their own."61level: medium